MS-102 Practice Test 10 — 10 Questions

Question 1

As a security administrator, you are tuning automated investigation and response (AIR) capabilities in Microsoft Defender XDR. You need to ensure that the system can automatically remediate threats while minimizing false positives. Which three of the following actions can be taken by automated investigation and response in Microsoft Defender XDR? (Choose three.)

Accepted Answer

Quarantine a file detected as malicious on a device. Automated investigation and response (AIR) in Microsoft Defender XDR can quarantine a file detected as malicious on a device by using built-in remediation actions that isolate the file from the operating system. It can also disable a compromised user account temporarily through integration with Microsoft Entra ID, applying a conditional account disable action to prevent further access. Additionally, AIR can delete an email message from a user's mailbox that was identified as phishing by leveraging Exchange Online Protection (EOP) and Microsoft Defender for Office 365 to perform mailbox-level remediation.

Answer

Uninstall an application from all devices in a tenant

Answer

Modify a Conditional Access policy to block all external access

Answer

Reset a user's password without administrator approval

Question 2

A company uses hybrid identity with Azure AD Connect and password hash synchronization. They want to enable Self-Service Password Reset (SSPR) with password writeback so that users can reset their on-premises Active Directory passwords. Which Azure AD license is required?

Accepted Answer

Azure AD Premium P1. Azure AD Premium P1 is required for Self-Service Password Reset (SSPR) with password writeback. Password writeback is a premium feature that enables password changes in Azure AD to be written back to on-premises Active Directory via Azure AD Connect. Azure AD Free does not include SSPR with writeback, and Azure AD Premium P2 includes additional features like Identity Protection but is not necessary for this scenario.

Answer

Azure AD Free

Answer

Azure AD Premium P2

Answer

Microsoft 365 E3

Question 3

A company uses Microsoft Entra ID P2 licenses and wants to enforce multi-factor authentication (MFA) for all users when accessing corporate applications. However, a small group of break-glass accounts must be excluded from MFA requirements to ensure emergency access. The administrator creates a Conditional Access policy targeting all users. Which configuration should be applied to achieve the exclusion?

Accepted Answer

Under 'Assignments' > 'Users and groups', select 'Exclude' and choose the security group containing break-glass accounts.. Option B is correct because Conditional Access policies in Microsoft Entra ID allow administrators to exclude specific users or groups from policy enforcement. By excluding the security group containing break-glass accounts under 'Assignments' > 'Users and groups', the MFA requirement is applied to all other users while ensuring emergency access accounts remain unblocked. This is the standard and recommended approach for handling break-glass accounts in a Conditional Access policy targeting all users.

Answer

Set 'Grant' control to 'Require multi-factor authentication' and include all users including break-glass accounts.

Answer

Under 'Session' controls, configure 'Sign-in frequency' with a value of 0 to disable MFA for break-glass accounts.

Answer

Create a separate policy for break-glass accounts that does not impose MFA and assign it a lower priority.

Question 4

Drag and drop the steps to configure Microsoft Intune device enrollment restrictions in the correct order.

Question 5

A company has 500 users across Sales, Marketing, and IT departments. User objects are synced from on-premises Active Directory to Microsoft Entra ID using Azure AD Connect. Each department requires different Microsoft 365 license plans (e.g., Sales needs E3, Marketing needs Business Premium, IT needs E5). The administrator wants to automatically assign the appropriate license based on the department attribute without manual intervention. Which approach should the administrator use?

Accepted Answer

Configure group-based licensing using Microsoft Entra dynamic groups with rules based on the department attribute.. Option B is correct because Microsoft Entra ID supports group-based licensing, which allows automatic license assignment to users based on their membership in dynamic groups. By creating dynamic groups with rules that filter on the department attribute (e.g., 'user.department -eq "Sales"'), the administrator can assign the appropriate license plan (E3, Business Premium, E5) to each group, and licenses are automatically applied or removed as users are added or removed from the group, without any manual or scripted intervention.

Answer

Create a script that runs daily to sync department values and assign licenses using PowerShell.

Answer

Use Azure AD Connect to filter objects and assign licenses during sync.

Answer

Manually assign licenses to each user in the Microsoft 365 admin center.

Question 6

A company uses Azure AD and SharePoint Online. They want to allow users from a partner organization (which also uses Azure AD) to access a specific SharePoint Online site using their existing partner credentials. The partner users should not require new accounts to be created. Which Azure AD feature should be configured?

Accepted Answer

Azure AD B2B collaboration. Azure AD B2B collaboration allows you to invite external users from a partner organization to access your Azure AD-integrated applications, such as SharePoint Online, using their own existing Azure AD credentials. This feature leverages cross-tenant trust and does not require creating new user accounts in your tenant, fulfilling the requirement exactly.

Answer

Azure AD B2C

Answer

Azure AD Domain Services

Answer

Organizational Relationships

Question 7

A company uses Azure AD Conditional Access to enforce MFA for all cloud apps. They have some users who are physically located in countries that are considered high-risk by the security team. The team wants to require device compliance (as defined by Intune) for sign-ins from those specific countries, while still requiring MFA from all other locations. How should the administrator configure the Conditional Access policy?

Accepted Answer

Create two Conditional Access policies: one for the high-risk countries requiring MFA and device compliance, and another for all other locations requiring only MFA. Option A is correct because Conditional Access policies are evaluated independently, and each policy can target specific conditions with distinct grant controls. By creating two separate policies—one for high-risk countries requiring both MFA and device compliance, and another for all other locations requiring only MFA—the administrator can enforce the exact requirements per location group. This approach avoids conflicts and ensures that users in high-risk countries are subject to stricter controls while others are not.

Answer

Create a single Conditional Access policy that includes both conditions (locations) and grant controls (MFA and device compliance) with an 'OR' operator

Answer

Use Azure AD Identity Protection to automatically evaluate location risk, and let Conditional Access apply the same policy to all users

Answer

Configure a single Conditional Access policy with multiple location conditions and multiple grant controls using an 'AND' operator

Question 8

A company uses Microsoft Entra ID P2 licenses. They want to block all authentication attempts from an internal app that uses legacy authentication protocols (POP3, IMAP, SMTP) because these protocols cannot enforce multi-factor authentication. Which Conditional Access policy setting should be used?

Accepted Answer

Block access for apps using legacy authentication. Option B is correct because the scenario explicitly requires blocking authentication attempts from an internal app using legacy protocols (POP3, IMAP, SMTP) that cannot enforce multi-factor authentication. The 'Block access for apps using legacy authentication' Conditional Access setting targets client apps that use legacy authentication protocols, effectively preventing any authentication from those apps regardless of user or device compliance.

Answer

Grant access requiring multi-factor authentication

Answer

Require compliant device

Answer

Require approved client app

Question 9

A company uses Azure AD Conditional Access. The security team wants to require multi-factor authentication (MFA) for all users when accessing the Azure portal, except when they are connecting from the corporate network (which is defined as a trusted location). How should the Conditional Access policy be configured?

Accepted Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = all locations, exclude the corporate network, Grant = Require multi-factor authentication.. Option A is correct because it targets only the Azure Portal (Microsoft Azure Management cloud app), applies MFA to all locations except the trusted corporate network, and excludes the corporate network from the policy. This ensures MFA is required for all access attempts from untrusted locations while allowing direct access from the corporate network without MFA.

Answer

Create a Conditional Access policy with all users, cloud apps = All cloud apps, Conditions > Locations = all locations, exclude the corporate network, Grant = Require multi-factor authentication.

Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = Corporate network, Grant = Block.

Answer

Create a Conditional Access policy with all users, cloud apps = Microsoft Azure Management, Conditions > Locations = Corporate network, Grant = Require multi-factor authentication.

Question 10

A company wants to automatically assign Microsoft 365 E5 licenses to all users in the Sales department. The department is identified by the department attribute in Microsoft Entra ID. The administrator needs to configure a method where licenses are assigned based on group membership, and the group membership is automatically updated based on user attributes. Which licensing approach should the administrator use?

Accepted Answer

Group-based licensing with a dynamic group that uses the department attribute.. Option B is correct because group-based licensing in Microsoft Entra ID allows automatic license assignment based on group membership, and a dynamic group can automatically update its membership using the department attribute rule (e.g., `user.department -eq "Sales"`). This meets the requirement for both automated license assignment and attribute-driven membership updates without manual intervention.

Answer

Per-user licensing with a PowerShell script.

Answer

Subscription-based licensing via the Microsoft 365 admin center.

Answer

Group-based licensing with an assigned group that must be manually updated.